epi052/feroxbuster · error

The regex ' ' matches ; the scan will never start

Error message

The regex '{}' matches {}; the scan will never start

What it means

get_targets performs a footgun check: for each target it tests every regex in the --dont-scan (regex_denylist) set, and if a denylist regex matches the base target itself, the entire scan would be filtered out, so it bails immediately. This prevents users from launching scans that can never scan anything.

Solutions

1. Rewrite the --dont-scan regex so it does not match the base target (e.g. anchor it: example.com/admin/ instead of example)
2. Escape regex metacharacters if the intent was a literal match
3. Remove the offending denylist entry and rely on narrower patterns
4. Test the regex against the base URL in a regex tester before running

Example fix

// before
ferox -u https://example.com --dont-scan example
// after
ferox -u https://example.com --dont-scan example.com/logout

denylist.forEach(r => { if (new RegExp(r).test(targetUrl)) console.error(`dont-scan regex '${r}' matches target ${targetUrl}`); });

When it happens

Trigger: A --dont-scan regex matches the base target string, e.g. ferox -u https://example.com --dont-scan example — the deny regex matches the root target so no URLs would ever be scanned.

Common situations: Users add a deny pattern meant to exclude a subdirectory or a parameter string but accidentally include the domain or a broad token (like the hostname, 'http', or '.com') that also matches the base URL.

Related errors

• The url ' ' matches ; the scan will never start
• Empty query string provided
• Empty key in query string
• Empty header provided
• Empty header name provided

AI-assisted analysis of epi052/feroxbuster@1f595dab5c (2026-09-13). Data as JSON: /api/errors/542cebb6cdd38177. Report an issue: GitHub.

Appendix: source

Thrown at src/main.rs:186

                // ferox_scans gets deserialized scans added to it at program start if --resume-from
                // is used, so scans that aren't marked complete still need to be scanned
                if scan.is_complete() || matches!(scan.scan_type, ScanType::File) {
                    // this one's already done, or it's not a directory, ignore it
                    continue;
                }

                targets.push(scan.url().to_owned());
            }
        };
    } else {
        targets.push(handles.config.target_url.clone());
    }

    // remove footgun that arises if a --dont-scan value matches on a base url
    for target in targets.iter_mut() {
        for denier in &handles.config.regex_denylist {
            if denier.is_match(target) {
                bail!(
                    "The regex '{}' matches {}; the scan will never start",
                    denier,
                    target
                );
            }
        }
        for denier in &handles.config.url_denylist {
            if denier.as_str().trim_end_matches('/') == target.trim_end_matches('/') {
                bail!(
                    "The url '{}' matches {}; the scan will never start",
                    denier,
                    target
                );
            }
        }

        if !target.starts_with("http") {
            // --url hackerone.com

View on GitHub (pinned to 1f595dab5c)